OnlyPatch
Windows Subsystem for Linux

CVE-2026-21237 — Windows Subsystem for Linux Elevation of Privilege Vulnerability

Important CVSS 7 EPSS 0.00261 🔬 Patch diffed 2026-02 archive

Executive Summary

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Weakness CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Released Feb 10 2026
Last Updated Feb 10 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00261 — 0.17857 percentile
NVD CVSS 7 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

0.00261
probability of exploitation in the next 30 days
0.17857 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

11 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 21H2 for 32-bit Systems 5075912 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5075912 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5075912 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5075912 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5075912 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5075912 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5075941 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5075941 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Important Elevation of Privilege 5073379 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.7840 10.0.26100.7781 Yes None Windows 11 Version 24H2 for x64-based Systems 5077212 (Security Hotpatch Update) 5077181 (Security Update) Important Elevation of Privilege 5074109 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.7781 10.0.26100.7840 Yes None Windows 11 Version 25H2 for ARM64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Important Elevation of Privilege 5074109 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.7840 10.0.26200.7781 Yes None Windows 11 Version 25H2 for x64-based Systems 5077181 (Security Update) 5077212 (Security Hotpatch Update) Important Elevation of Privilege 5074109 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.7840 10.0.26200.7781 Yes None Windows 11 Version 26H1 for ARM64-based Systems 5077179 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 26H1 for x64-based Systems 5077179 (Security Update) Important Elevation of Privilege Yes
Windows Server 2022 5075906 (Security Update) 5075943 (Security Hotpatch Update) Important Elevation of Privilege 5073457 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.4773 10.0.20348.4711 Yes None Windows Server 2022 (Server Core installation) 5075906 (Security Update) 5075943 (Security Hotpatch Update) Important Elevation of Privilege 5073457 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.20348.4773 10.0.20348.4711 Yes None Windows Server 2022, 23H2 Edition (Server Core installation) 5075897 (Security Update) Important Elevation of Privilege Yes

Patches

4 patches
Article Type Restart
5075912 Security Update Yes
5075941 Security Update Yes
5077179 Security Update Yes
5075897 Security Update Yes

Patch Diff

ghidriff · p9rdr.sys (KB5077181)

Race-condition use-after-free (CWE-362 + CWE-416) in the Windows 9P/WSL redirector p9rdr.sys UserCallback/Waiter mechanism, local EoP. Opening \Device\P9Rdr\<distro>\... drives p9fs::P9CreateVNetRoot -> Device::CallUserCallback -> UserCallbackManager::CallUserCallback; when no callback is registered it calls NotifyUserProcess, which signals P9RdrService (WNF), creates a _P9RDR_USER_CALLBACK, adds it to the manager list, and attaches a _P9RDR_WAITER targeting the create IRP's RxContext (RxContext+0xD0); control returns and rdbss RxCancellableWaitSync waits on RxContextForCreate->ConditionEvent. The callback/waiter objects (which reference the create-IRP RxContext and carry a PEX_TIMER) had inadequately synchronized lifetime: between register and wait, the timer firing / the user-mode service responding / a cancel can free the callback (and waiter) while another path still uses it (or the RxContext) -> UAF. Diff of p9rdr.sys 10.0.26100.7824 -> .8328 (Feb 10 2026, KB5077181) confirms the fix: gated behind CFR flags Feature_1655910715 / Feature_3906416953, the changed functions p9fs::UserCallbackManager::RegisterUserCallback, p9fs::UserCallback::SetCallbackTimeout and p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld add explicit reference management (FindOrInsertCallbackWithLockHeld calls UserCallback::ReleaseReference under the manager lock) and rework the ExSetTimer timeout, so the callback/waiter/RxContext cannot be freed while still in use. Note: our diff shows Feature_1655910715/Feature_3906416953 (build/arch); function names refactored (FindCallback->FindOrInsertCallback) vs the reporter analysis.

Pre-patch version 10.0.26100.7824 Download
Post-patch version 10.0.26100.8328 Download
Function Address Change Note
p9fs::UserCallbackManager::FindOrInsertCallbackWithLockHeld code change code (reference release under manager lock, CFR-gated) Adds UserCallback::ReleaseReference(*(UserCallback**)(entry+0x58)) so the callback is reference-counted and released under the manager lock, preventing use of a freed callback.
p9fs::UserCallback::SetCallbackTimeout code change code (timeout rework) Reworks the ExSetTimer callback timeout so the timer firing cannot free the callback while it is still referenced by the waiting RxContext path.
p9fs::UserCallbackManager::RegisterUserCallback code change code (callback registration lifetime) Registration reworked alongside the reference-management fix for the UserCallback/waiter lifetime.
Feature_1655910715 / Feature_3906416953 gate added (CFR gate) CFR flags gating the reference-managed UserCallback lifetime fix; original path still ships when disabled.
View full diff report View RCA report

Attack Path

A 9P VNetRoot create registers a user-callback+waiter bound to the create RxContext, which a concurrent timeout/response frees mid-wait

Attack path for CVE-2026-21237 A 9P VNetRoot create registers a user-callback+waiter bound to the create RxContext, which a concurrent timeout/response frees mid-wait 01 — ENTRY Local user opens \Device\P9Rdr\<distro>\... (e.g. \\wsl.localhost) p9rdr.sys P9CreateVNetRoot -> CallUserCallback; with no callback registered it calls NotifyUserProcess. AV:L/PR:L, AC:H (race). 02 — CONTROLLED INPUT NotifyUserProcess creates a _P9RDR_USER_CALLBACK + _P9RDR_WAITER bound to the create RxContext The waiter targets RxContext+0xD0; the callback carries a PEX_TIMER timeout and is added to the UserCallbackManager list. rdbss then waits on RxContext->ConditionEvent. 03 — PATH A concurrent event (timer fires / P9RdrService responds / cancel) tears down the callback The callback/waiter lifetime is not consistently reference-counted/locked across the notify->wait window. 04 — MISSING CHECK Callback/waiter (or the RxContext it references) freed while still in use (CWE-362 -> CWE-416) One path frees the object the other still dereferences. 05 — PRIMITIVE Use of the freed UserCallback/waiter/RxContext -> use-after-free -> EoP The kernel reuses freed pool referencing the create IRP. The Feb 2026 fix (Feature_1655910715/3906416953) reference-counts the callback and releases it under the manager lock, and reworks the timeout.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

ChenJian with Sea Security Orca Team

On This Page